[Bug] bundled CA root certificates not found in production

[nktnet1]

This is not working for me in production (works fine in development before bunding):

This project bundles and uses CA root certificates from the python-ceritfi project.

Error:

Connecting to Pub/Sub API
Failed to connect Error: Failed to connect to Pub/Sub API
    at PubSubApiClient.connect (file:///path/.output/server/_libs/salesforce-pubsub-api-client.mjs:17403:10)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    ... 5 lines matching cause stack trace ...
    at async file:///path/.output/server/_libs/@orpc/client.mjs:676:36
    at async file:///path/.output/server/_libs/@orpc/client.mjs:103:20
    at async file:///path/.output/server/_libs/@orpc/client.mjs:678:12 {
  [cause]: Error: ENOENT: no such file or directory, open '/path/.output/server/_libs/cacert-2ebcb9e8.pem'
      at Object.openSync (node:fs:560:18)
      at Object.readFileSync (node:fs:444:35)
      at PubSubApiClient.connect (file:///path/.output/server/_libs/salesforce-pubsub-api-client.mjs:17387:24)

The application is a simple Tanstack Start + vite + nitro project.

import { defineConfig } from "vite";
import tailwindcss from "@tailwindcss/vite";
import tsConfigPaths from "vite-tsconfig-paths";
import { tanstackStart } from "@tanstack/react-start/plugin/vite";
import { nitro } from "nitro/vite";
import viteReact from "@vitejs/plugin-react";

export default defineConfig({
  plugins: [
    tailwindcss(),
    tsConfigPaths(),
    tanstackStart(),
    nitro(),
    viteReact(),
  ],
});

The command used after building is

node .output/server/index.mjs

I assume the issue is with this part here, which doesn't seem very portable:

pub-sub-api-node-client/src/client.js

Lines 146 to 150 in 66e2d5d

	this.#logger.debug(`Connecting to Pub/Sub API`);
	// Read certificates
	const rootCert = fs.readFileSync(
	fileURLToPath(new URL('./certs/cacert.pem', import.meta.url))
	);

---

If we attempt to patch this with a hack:

cp ./node_modules/salesforce-pubsub-api-client/dist/*.pem .output/server/_libs/

There is still the issue of fs being null:

Connecting to Pub/Sub API
Failed to connect Error: Failed to connect to Pub/Sub API
    at PubSubApiClient.connect (file:///path/.output/server/_libs/salesforce-pubsub-api-client.mjs:17403:10)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    ... 2 lines matching cause stack trace ...
    at async file:///path/.output/server/_libs/@orpc/client.mjs:155:19
    at async file:///path/.output/server/_libs/@orpc/client.mjs:103:20
    at async file:///path/.output/server/_libs/@orpc/client.mjs:678:12
    at async file:///path/.output/server/_libs/@orpc/client.mjs:676:36
    at async file:///path/.output/server/_libs/@orpc/client.mjs:103:20
    at async file:///path/.output/server/_libs/@orpc/client.mjs:678:12 {
  [cause]: TypeError: Cannot read properties of null (reading 'readFileSync')
      at fetch$1 (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:6263:25)
      at Root$3.load$3 [as load] (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:6287:115)
      at Root$3.loadSync$2 [as loadSync] (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:6297:15)
      at loadProtosWithOptionsSync (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:8818:29)
      at Object.loadSync (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:9772:73)
      at PubSubApiClient.connect (file:///path/.output/server/_libs/salesforce-pubsub-api-client.mjs:17389:44)
      at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
      at async initPubsub (file:///path/.output/server/_ssr/router-BHZW07Zt.mjs:196:3)
      at async Object.handler (file:///path/.output/server/_ssr/router-BHZW07Zt.mjs:223:2)
      at async file:///path/.output/server/_libs/@orpc/client.mjs:155:19
}

which this time is caused by the @grpc/proto-loader dependency:

pub-sub-api-node-client/src/client.js

Line 156 in 66e2d5d

const packageDef = protoLoader.loadSync(protoFilePath, {});

---

Can any of these behaviour be opt-out and for the certs to be provided manually?

[nktnet1]

For the time being, the most promising workaround is to simply not bundle this library:

import { defineConfig } from "vite";
import tailwindcss from "@tailwindcss/vite";
import tsConfigPaths from "vite-tsconfig-paths";
import { tanstackStart } from "@tanstack/react-start/plugin/vite";
import { nitro } from "nitro/vite";
import viteReact from "@vitejs/plugin-react";

export default defineConfig({
  plugins: [
    tailwindcss(),
    tsConfigPaths(),
    tanstackStart(),
    nitro(),
    viteReact(),
  ],
  build: {
    rolldownOptions: {
      external: ["salesforce-pubsub-api-client"],
    },
  },
});

and manage it externally. Still testing the best way to ship this in production.

[pozil]

Hi @nktnet1, this client requires the node.js runtime not just for the build but for actual execution.
This implementation of gRPC is not meant to run on the browser side. Furthermore, you don't want this client to run on the browser from a security point of view because you would be exposing sensitive credentials.

The right approach is to use this client in a middleware and use a WebSocket or SSE connection on the browser side to reach the middleware. See this app for an example.

[nktnet1]

Hey @pozil - thanks for replying.

I don't think my application is running this on the browser - it's used strictly server side. But yes, I am using SSE (via oRPC) to get the information to the client.
Everything works in development, just not when bundling & shipping.

If we look at:

pub-sub-api-node-client/src/client.js

Lines 148 to 156 in 66e2d5d

	const rootCert = fs.readFileSync(
	fileURLToPath(new URL('./certs/cacert.pem', import.meta.url))
	);
	// Load proto definition
	const protoFilePath = fileURLToPath(
	new URL('../pubsub_api.proto', import.meta.url)
	);
	const packageDef = protoLoader.loadSync(protoFilePath, {});

at line 148, fs.readFileSync is defined, hence the first issue with "No such file or directory".

---

The second issue with fs being null in line 156 seems to be caused by the @grpc/grpc-js or @grpc/proto-loader.

Perhaps it could also be an issue with bundling in tanstack start / nitro. However, you can see from the stacktrace in my logs that it's coming out of

file:///path/.output/server/.*

instead of

file:///path/.output/public/assets/.*

so I think it's less likely to be the case.

[nktnet1]

@pozil I added a minimal reproducible example here:

• https://github.com/nktnet-bug-report/sf-pubsub-api-test

---

In production, the workaround I've implemented for now is:

1. Keep the salesforce-pubsub-api-client dependency external:

   import { defineConfig } from "vite";
   import tailwindcss from "@tailwindcss/vite";
   import tsConfigPaths from "vite-tsconfig-paths";
   import { tanstackStart } from "@tanstack/react-start/plugin/vite";
   import { nitro } from "nitro/vite";
   import viteReact from "@vitejs/plugin-react";
   
   export default defineConfig({
     plugins: [
       tailwindcss(),
       tsConfigPaths(),
       tanstackStart(),
       nitro(),
       viteReact(),
     ],
     build: {
       rolldownOptions: {
         external: ["salesforce-pubsub-api-client"],
       },
     },
   });

2. Create a package.external.json with just the salesforce-pubsub-api-client dependency

   {
     "type": "module",
     "dependencies": {
       "salesforce-pubsub-api-client": "^5.5.2"
     }
   }

3. Replace package.json with the external after building (bundling), install again, then copy the minimal node_modules to production

   FROM node:24-slim AS base
   
   WORKDIR /app
   
   #============================================================================ #
   
   FROM base AS builder
   
   RUN corepack enable pnpm
   
   COPY package.json pnpm-lock.yaml ./
   RUN pnpm install
   
   COPY . .
   
   RUN pnpm build
   
   # Add this:
   COPY package.external.json ./package.json
   RUN pnpm install --no-lockfile --offline
   
   #============================================================================ #
   
   FROM base AS runtime
   
   RUN addgroup --system --gid 1001 nodejs \
       && adduser --system --uid 1001 --ingroup nodejs nodejs
   
   COPY --from=builder --chown=nodejs:nodejs /app/.output/server ./server
   COPY --from=builder --chown=nodejs:nodejs /app/.output/public ./public
   
   # Add this:
   COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
   
   USER nodejs
   
   ENV NODE_ENV=production
   ENV PORT=3000
   
   EXPOSE 3000
   
   CMD ["node", "server/index.mjs"]

[pozil]

Thanks for the extra details @nktnet1. I'll be honest, I haven't used this stack so my expertise is limited with this.
What I meant with my previous response is that this library is purely backend so it shouldn't be bundled with frontend components like React or Tailwind. It's likely a matter of configuration of your stack.